where \(n\)  is the number of clients selected in each iteration, and \(N\)  is the total number of clients. For a small local learning rate which is common in DL, the model parameters change consistently in the training procedure. The gradients of each client during several iterations are approximately equal. Therefore, this is approximately equivalent to the case of the initiator node being selected in every iteration, corresponding to a well-applied technique in existing strong backdoor attacks [1]}, [2]}. Our method thus has a consistent updating process to improve the stability of model convergence while performing well for watermarking.
